v4.69.2

4.69.2 — patch

fix(sdk): a cold open accepts a key_envelope wrapped by ANY chain-admitted writer, verified under that writer's key (gitvault-multi-writer, rev 47). With writers plural, whichever key-holder reconciles first wraps a new member's envelope — a handoff-admitted writer as readily as the creator. restoreRepoFromEnvelope still enforced the single-writer rule for a non-creator envelope (created_by had to be the genesis writer, and the signature was checked with the creator's key only), so the member's first clone died VAULT_CREATION_CONFLICT (problems: ["stored_envelope_created_by"]); the same rule would have refused every cold open after an epoch rotation performed by a non-genesis writer.

The cold open now resolves the vault's admitted writer set from the chain itself — every admitted head hash-checked against the listing, signature-verified under the writer the chain admits at that point, add_writer_key / writer_set_update transitions applied in order, no decryption — exactly when the wrapper is not the genesis writer, and passes it as admitted_writers (new optional input of restoreRepoFromEnvelope). Fails closed on any chain defect.

Lockstep: run402-mcp, run402 (CLI), @run402/sdk. @kychee/kygit 0.2.0 picks this up through its ^4.67.0 dependency — upgrade with npm i -g run402@4.69.2 @kychee/kygit@0.2.0.